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DETAILED ACTION 

1 . This office action is in response to the amendment filed 1 1/03/05. 

2. Claims 3 and 1 0 were amended. 

3. Claim 23 is canceled. 

4. Claims 1 -22 and 24 are pending in this office action. 



Response to Amendment 

5. The declaration filed on 1 1 /03/05 under 37 CFR 1 . 1 31 is sufficient to overcome 
the Spasojevic reference (U.S. Patent 6,262,410). Accordingly, the rejection of claims 
4-6, 10, 15, 17 and 18 under 35 U.S.C. 102(e) as being anticipated by Spasojevic, is 
withdrawn. 

6. The objection to claim 3 is withdrawn. 

7. Applicant's arguments filed 1 1/03/05 have been fully considered but they are not 
persuasive. See Response to Arguments. Accordingly, the previous grounds of 
rejection in relation to AganA^al and Agarwal in view of Khanna are maintained and this 
action is made Final. 
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Claim Rejections - 35 USC § 102 

8. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty In the English language. 

9. Claims 1-6, 10-18, 21, 22 and 24 are rejected under 35 U.S.C. 102(e) as being 
anticipated by U.S. Patent 5,958,010 by AganA/al et al. (Argawal). 

10. With respect to Claim 1 , Argawal teaches a method of tracing data traffic on a 
network, the method comprising: at the transport layer of a protocol stack residing on a 
first device in the network (Col. 9 lines 1-25), detecting a transmission or receipt of data 
to or from a second device on the network (Col. 9 lines 1-25 and Col. 8 lines 3-26); and 
in response to the transmission or receipt being detected, recording the transmission or 
receipt as an entry in a trace log (Col. 5 lines 39-55 and Col. 8 lines 27-53), wherein the 
trace log is accessible to determine the volume of data traveling over a network (Col. 5 
lines 39-55). 

1 1 . With respect to Claim 2, Argawal teaches all the limitations of Claim 1 and further 
teaches wherein the protocol stack is a TCP/IP stack (Col. 9 lines 1-25). 

12. With respect to Claim 3, Argawal teaches all the limitations of Claim 1 and further 
teaches the detection step further comprises the step of detecting the presence of an 
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input/output packet representing the transmission or receipt (Col. 9 lines 1-25 and Col. 8 
lines 27-53). 

13. With respect to Claim 4, Argawal teaches a method of tracing a transmission of 
data over a computer network comprising: detecting a transport-layer request to 
transmit an input/output packet (Col. 9 lines 1-25 and Col. 8 lines 3-26); searching the 
input/output packet to determine an identity of a process that created the input/output 
packet (CoL 6 lines 10-30, Col. 7 lines 34-45, and Col. 8 lines 27-66); and storing in a 
trace log an entry representing the request, wherein the entry comprises the identity of 
the process, and wherein the trace log is accessible to determine a volume of data 
being transmitted over the network (Col. 5 lines 39-55, Col. 6 lines 10-30, Col. 7 lines 
34-45, and Col. 8 lines 27-66). 

14. With respect to Claim 5, Argawal teaches all the limitations of Claim 4 and further 
teaches detecting an acknowledgement of the transmission (Col. 9 lines 1-25 and CoL 8 
lines 3-26); and in response to the detection of the acknowledgement, storing in the 
trace log an entry representing the completion of the transmission (Col. 5 lines 39-55 
and Col. 8 lines 27-66). 

1 5. With respect to Claim 6, Argawal teaches a method of tracing a receipt of data 
from a computer network comprising: detecting a transport-layer request to transmit a 
packet for an input/output connection to a port (Col. 9 lines 1-25 and Col. 8 lines 3-26: a 
port connection is inherent in TCP); searching the packet to determine an identity of a 
process that created the packet (Col. 6 lines 10-30, CoL 7 lines 34-45, and CoL 8 lines 
27-66); and in response to the detection of a receipt of data at the port, storing in a trace 
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log an entry representing the receipt of the data, wherein the entry comprises the 
process identification, , and wherein the trace log is accessible to determine a volume of 
data being transmitted over the network (Col. 5 lines 39-55, Col, 6 lines 10-30, Col. 7 
lines 34-45, and Col. 8 lines 27-66). 

16. With respect to Claim 10, Argawal teaches a facility for tracing data traffic on a 
network at the transport layer, the facility comprising: an identifying means for 
identifying a process causing a transport-layer request to transmit data via the network 
(Col. 6 lines 10-30, Col. 7 lines 34-45, and Col. 8 lines 27-66); and a logging means in 
communication with the identifying means for logging an event, wherein the event 
comprises the identification of the process and wherein the logging means is useable to 
determine a volume of data traveling over the network (Col. 5 lines 39-55, Col. 6 lines 
10-30, Col. 7 lines 34-45, and Col. 8 lines 27-66). 

1 7. With respect to Claim 1 1 , Argawal teaches all the limitations of Claim 1 0 and 
further teaches the identifying means further comprises means for communicating with 
a transport layer of a protocol stack (Col. 9 lines 1-25 and Col. 8 lines 3-26). 

18. With respect to Claim 12, Argawal teaches a computer readable medium having 
stored thereon computer executable instructions for performing steps comprising: at the 
transport layer of a protocol stack residing on a first device in the network (Col. 9 lines 
1- 25), detecting a transmission or receipt of data to or from a second device on the 
network (Col. 9 lines 1-25 and Col. 8 lines 3-26); and in response to the transmission or 
receipt being detected, recording the transmission or receipt as an entry in a trace log 
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(Col. 5 lines 39-55 and Col. 8 lines 27-53), wherein the trace log is accessible to 
determine the volume of data traveling over a network (Col. 5 lines 39-55). 

19. With respect to Claim 13, Argawal teaches all the limitations of Claim 12 and 
further teaches wherein the protocol stack is a TCP/IP stack (Col. 9 lines 1-25). 

20. With respect to Claim 14, Argawal teaches all the limitations of Claim 12 and 
further teaches having further computer executable instructions for performing the step 
of detecting the presence of an input/output packet representing the transmission or 
receipt (Col. 9 lines 1-25 and Col. 8 lines 27-53). 

21 . With respect to Claim 15, Argawal teaches a computer readable medium having 
stored thereon computer executable instructions for performing steps comprising: 
detecting a transport-layer request to transmit an input/output packet (Col, 9 lines 1-25 
and Col. 8 lines 3-26); searching the input/output packet to determine an identity of a 
process that created the input/output packet (Col. 6 lines 10-30, Col. 7 lines 34-45, and 
Col. 8 lines 27-66); and storing in a trace log an entry representing the request, wherein 
the entry comprises the identity of the process, and wherein the trace log is accessible 
to determine a volume of data being transmitted over the network (Col. 5 lines 39-55, 
Col. 6 lines 10-30, CoL 7 lines 34-45, and Col. 8 lines 27-66). 

22. With respect to Claim 16, Argawal teaches all the limitations of Claim 15 and 
further teaches having further computer-executable instructions for performing the step 
of detecting the presence of the input/output packet at the transport layer of a protocol 
stack (Col. 9 lines 1-25 and CoL 8 lines 27-53). 
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23. With respect to Claim 17, Argawal teaches all the limitations of Claim 15 and 
further teaches having further computer-executable instructions for performing the step 
of detecting an acknowledgement of the transmission (Col. 9 lines 1-25 and Col, 8 lines 
3-26); and in response to the detection of the acknowledgement, storing in the trace log 
an entry representing the completion of the transmission (Col. 5 lines 39-55 and Col. 8 
lines 27-66). 

24. With respect to Claim 18, Argawal teaches a computer readable medium having 
stored thereon computer executable instructions for performing steps comprising: 
detecting a transport-layer request to transmit a packet for an input/output connection to 
a port (Col. 9 lines 1-25 and Col. 8 lines 3-26); searching the packet to determine an 
identity of a process that created the packet (Col. 6 lines 10-30, Col. 7 lines 34-45, and 
Col. 8 lines 27-66); and in response to the detection of a receipt of data at the port, 
storing in a trace log an entry representing the receipt of the data, wherein the entry 
comprises the process identification, , and wherein the trace log is accessible to 
determine a volume of data being transmitted over the network (Col. 5 lines 39-55, Col. 
6 lines 10-30, Col. 7 lines 34-45, and Col. 8 lines 27-66). 

25. With respect to Claim 21 , Argawal teaches all the limitations of Claim 18 and 
further teaches having further computer-executable instructions for performing the steps 
of: detecting the presence of an input/output request packet indicating that the data 
receipt is complete (Col. 9 lines 1-25 and Col. 8 lines 3-26); and in response to the 
detection of the completion input/output request packet, storing in the trace log an entry 
representing the receipt of the data (Col. 5 lines 39-55 and Col. 8 lines 27-66). 
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26. With respect to Claim 22, Argawal teaches all the limitations of Claim 1 and 
further teaches wherein the transmission of data is recorded at the completion of the 
transmission indicated by an acknowledgment from the first device (Col. 9 lines 1-25 
and Col. 8 lines 3-26). 

27. With respect to Claim 24, wherein the identity of the process includes a port 
number of an IP address relating to the transmission (Col. 8 lines 27-66). 



Claim Rejections - 35 USC § 103 

28. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

29. Claims 7-9, 19 and 20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Argawal in view of U.S. Patent 5,978,849 by Khanna (Khanna). 

30. With respect to Claim 7, Argawal teaches creating a connection object 
representing the opening of the port connection by the process (Col. 9 lines 1-25 and 
Col. 8 lines 3-26) and in response to the detection of the receipt of data at the port, 
copying the process identification into the trace log (Col. 5 lines 39-55 and Col, 8 lines 
27-66). 

31 . Argawal does not explicitly disclose copying the process identification from the 
connection object into a transport control block associated with the port. Khanna 
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teaches that it is well known in the art that a process identity related to an established 
connection can be copied into a transport control block (TCB) (Col. 5 lines 18-43). 

32. It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the method disclosed by Argawal and modify it as indicated 
by Kanna such that the method further comprises copying the process identification 
from the connection object into a transport control block associated with the port. Such 
a modification would allow a simple way to correlate events occurring at the TCP level 
in relation to stored context information (In Argawal: Col. 8 lines 27-58). One would be 
motivated to have this, as there is need for the correlation of events at certain 
transaction levels in providing an analysis of system performance (In Argawal: Col. 8 
lines 54-67 and Col. 3 lines 3-9 and Col. 2 lines 46-50). 

33. With respect to Claim 8, Argawal in view of Khanna teaches all the limitations of 
Claim 7 and further teaches copying the process identification from the connection 
object into the transport control block so that the process identification is contiguous 
with the rest of the data in the transport control block (The combination of Argawal and 
Khanna in the rejection of Claim 7 would provide for such a limitation). 

34. With respect to Claim 9, Argawal in view of Khanna teaches all the limitations of 
Claim 8 and further teaches detecting the presence of an input/output request packet 
indicating that the data receipt is complete (In Argawal: Col. 9 lines 1-25 and Col. 8 lines 
3-26); and in response to the detection of the completion input/output request packet, 
storing in the trace log an entry representing the receipt of the data (In Argawal: Col. 5 
lines 39-55 and Col. 8 lines 27-66). 
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35. With respect to Claim 19, Argawal teaches all the limitations of Claim 18 and 
further teaches having further computer-executable instructions for performing the step 
of creating a connection object representing the opening of the port connection by the 
process (Col. 9 lines 1-25 and CoL 8 lines 3-26) and in response to the detection of the 
receipt of data at the port, copying the process identification into the trace log (Col. 5 
lines 39-55 and Col. 8 lines 27-66). 

36. Argawal does not explicitly disclose copying the process identification from the 
connection object into a transport control block associated with the port. Khanna 
teaches that it is well known in the art that a process identity related to an established 
connection can be copied into a transport control block (TCB) (Col. 5 lines 18-43). 

37. It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the computer-readable medium disclosed by Argawal and 
modify it as indicated by Kanna such that the computer-readable medium further 
comprises copying the process identification from the connection object into a transport 
control block associated with the port. Such a modification would allow a simple way to 
correlate events occurring at the TCP level in relation to stored context information (In 
Argawal: Col. 8 lines 27-58). One would be motivated to have this, as there is need for 
the correlation of events at certain transaction levels in providing an analysis of system 
performance (In Argawal: Col. 8 lines 54-67 and Col. 3 lines 3-9 and CoL 2 lines 46- 
50). 

38. With respect to Claim 20, Argawal in view of Khanna teaches all the limitations of 
Claim 19 and further teaches having further computer-executable instructions for 
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performing the step of copying the process identification from the connection object into 
the transport control block so that the process identification is contiguous with the rest of 
the data in the transport control block (The combination of Argawal and Khanna in the 
rejection of Claim 19 would provide for such a limitation). 



Response to Arguments 

39. Applicant's arguments filed 1 1/03/05 have been fully considered but they are not 
persuasive. 

40. Applicants argue on page 8 of the remarks "However, Agatwal does not teache 
event tracing at the transport layer of a protocol stack. Rather, Argawal discloses the 
use of agent modules which attach on top of the TCP device to monitor traffic in and out 
of managed nodes. . .Agarwal does not disclose the independent claim 1, 10 an 12 
element of monitoring at the transport level as disclosed by the present application." 

a. Examiner's response - The examiner reminds the applicants that a 

protocol stack is essentially a high level model of how network data and its 
associated protocols should flow through a given node. As such, the language of 
"at the transport layer'' is very broad as it does not necessarily define a specific 
implementation of hardware and/or software. At best, "at the transport layer" 
defines a close relationship to where the processing of transport protocols 
occurs. Agarwal describes the actual implementation of part of the transport 
layer processing in relation to the TCP/IP drivers and particularly the TCP device. 
The monitoring structure of Aganval is directly coupled to this transport layer 
processing for the specific purpose of monitoring TCP data. TCP is a transport 
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layer protocol. As such, TCP data would be processed at the transport layer. 
The examiner does not see how the direct coupling to a TCP driver device and 
the explicitly monitoring of TCP data could not be considered to be "at the 
transport layer''. In other words, the examiner interprets the "use of agent 
modules which attach on top of the TCP device" to have the meaning of "at the 
transport layer of a protocol stack". In fact, the claim language used by Agarwal 
in claim 17 states, "wherein monitoring said application data includes accessing 
said communications stack at a transport laver" (emphasis added). Applicants' 
arguments are not persuasive. 

41 . Applicants argue on page 8 and page 10 - ''Agarwal does not describe "tracing 
data traffic on a network at tlie transport layer"' or "identifying processes causing 
transport-layer requests to transmit".. Agarwal does not teach the claim element of 
"searching the [input/output packet or packet] to determine the identity of a process that 
created the [input/output packet or packet] and storing in a trace log an entry 
representing the [request or data]. " Agarwal merely discloses the storage of stream 
information describing the type of connection" 

b. Examiner's response - The underlying purpose of Agarwal's invention is 

for monitoring and management of distributed applications, databases, networks 

and systems for multiple purposes including trouble shooting, trend analysis, 

resource planning, security auditing, etc. (Col. 3 lines 10-32). Monitoring agents 

are provided to provide such monitoring. Particularly, Col. 5 lines 30-34, states, 

"Moreover, a monitoring agent is associated with each component of the network 

to provide for enterprise wide monitoring, as all the processes, including those 
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that are distributed, on the clients and the servers can be monitored." In order to 
monitor particular processes, the context data structure and lists are used as 
described in Col. 8 lines 19-53. Particularly, one form of identifying a particular 
process is through resolving an address identified in the TCP data to see if it is 
on the list to be monitored (Col. 3 lines 40-53). If it is to be monitored, 
information related to the TCP data is monitored, stored and used for purposes 
as described. The examiner considers this to be within the scope of the claim 
limitations. Applicants' arguments are not persuasive. 

42. Applicants argue on page 1 1 - ''Combining Agarwal and Khanna not teach or 
suggest all of the claim limitations of claim 7. First, while claim 7 describes creating a 
connection object representing the opening of the port connection by the process, 
Agarwal describes autonomous module agents which are "autopush[ed] on top of the 
TCP STREAMS stack so that all TCP traffic in and out of the managed node passes 
through the module." Col. 8, lines 11-14. Furthermore, other embodiments ofAgarwal's 
agent structures autonomously "monitor all TCP traffic in and out of the managed node" 
through the "TAP driver" and are not created as a representation of the opening of the 
port connection by the process as described in claim 7. Col. 9, lines 16-17. Accordingly, 
the "creating a connection object representing the opening of the port connection by the 
process" element is not taught or suggested" 

c. Examiner's response - Agarwal teaches that each connected stream, 

including those to be monitored, creates a context data structure for storing 

information related to that connection (Col. 8 lines 27-53), The claim language 

does not describe any specific limitations related to what information the 

connection object contains. As such, the examiner considers the context data 
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structure to be within the scope of the claim limitations. Applicants' arguments 
are not persuasive. 



43. Applicants argue on pages 1 1-12 - "Likewise, the creation of a connection object 
which uses the well-known Transport Control Block (TCB) to create a log of network 
activity as claimed in claim 7 is not present in Agarwal or Khanna. In Khanna, the well- 
known TCB structure is described as merely keeping track of network connections. As 
claimed in claim 7, the created connection object first records each process 
identification into the TCB, then, once the connection object detects data at the port, the 
claimed object further copies the process identification into a trace log which is separate 
from the well-known TCB." 

44. Examiner's response - The rejection of claim 7 does not state that argued 
limitation is expressly claimed in either Agarwal or Khanna. The rejection of claim 7 
instead suggests that the argued limitation is suggested and is obvious based on the 
combined teachings of AganA^al and Khanna. In re Keller, Terry, and Davies, 208 
USPQ 871 (CCPA 1981 ) states, "Test of obviousness is not whether features of 
secondary reference may be bodily incorporated into primary reference's structure, nor 
whether claimed invention is expressly suggested in any one or all of references; rather, 
test is what combined teachings of references would have suggested to those of 
ordinary skill in art." Additionally, one cannot show nonobviousness by attacking 
references individually where the rejections are based on combinations of references. 
See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 
F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). 
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45. Applicants argue on pages 12-1 3 - 'Turthermore, independent claims 6 and 18 
teacli tracing each individual packet across the TCP stack rather than merely the 
existence of network connections as recorded in the TCB and described by 
Khanna,:.The TCB structure described in Khanna, which is well-known in the art, does 
not trace each packet as it crosses the TCP stack. ..The combination ofAgarwal and 
Khanna does not teach or suggest all of the limitations found in independent claims 6 
and 18." 

d. Examiner's response - Khanna is not relied upon for the rejection of 
Claims 6 and 18. Claims 6 and 18 are rejected under 102(e) as being 
anticipated by Agarwal. 

Conclusion 

46. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 



Application/Control Number: 09/490,981 



Page 16 



Art Unit: 2155 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to David Lazaro whose telephone number is 571-272- 
3986. The examiner can normally be reached on 8:30-5:00 M-F. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Saleh Najjar can be reached on 571-272-4006. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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